Abstract: Methods, systems, and computer program products for performing a trace of a communications transaction using a dynamically generated endpoint identifier list are disclosed. According to one method, a first endpoint identifier for identifying a communications endpoint is received. A list including the first endpoint identifier is created. A signaling message including the first endpoint identifier may be searched for in the list. A parameter from the signaling message having the first endpoint identifier may be extracted that is distinct from the endpoint identifier. Further, the method may include searching for signaling messages having the extracted parameter. The method may include adding to the list any endpoint identifiers found in the search for signaling messages having the extracted parameter. The method may include searching for signaling messages having any of the endpoint identifiers in the list and thereby tracing a communications transaction involving endpoints in the endpoint identifier list.

Abstract: Method, systems, and computer program products for identifying the application-level protocol of a signaling message are disclosed. According to one method, a message copied by a network monitoring system is received. The service indicator in the message is examined to determine whether more than one application-level protocol is possible. If more than one application-level protocol is not possible, the application-level protocol is identified based on the service indicator. If more than one application-level protocol is possible, additional message attributes are individually examined to determine whether identification of the application-level protocol is possible based on each attribute. The application-level protocol is identified based on the first attribute for which identification is determined to be possible.